CVE-2013-6618 : Détail

CVE-2013-6618

A03-Injection
2.93%V3
Network
2013-11-05
19h00 +00:00
2017-08-28
10h57 +00:00
CVE.org
NVD
Notifications pour un CVE
Restez informé de toutes modifications pour un CVE spécifique.
Gestion des notifications

Descriptions du CVE

jsdm/ajax/port.php in J-Web in Juniper Junos before 10.4R13, 11.4 before 11.4R7, 12.1 before 12.1R5, 12.2 before 12.2R3, and 12.3 before 12.3R1 allows remote authenticated users to execute arbitrary commands via the rsargs parameter in an exec action.

Informations du CVE

Faiblesses connexes

CWE-ID Nom de la faiblesse Source
CWE-20 Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Métriques

Métriques Score Gravité CVSS Vecteur Source
V2 9 AV:N/AC:L/Au:S/C:C/I:C/A:C nvd@nist.gov

EPSS

EPSS est un modèle de notation qui prédit la probabilité qu'une vulnérabilité soit exploitée.

Score EPSS

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Percentile EPSS

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.
EPSS First.org

Informations sur l'Exploit

Exploit Database EDB-ID : 29544

Date de publication : 2013-11-11 23h00 +00:00
Auteur : Sense of Security
EDB Vérifié : No

Sense of Security - Security Advisory - SOS-13-003 security advisory Release Date. 10-Sep-2013 Last Update. - Vendor Notification Date. 27-Sep-2012 Product. Juniper Junos J-Web Platform. Junos Affected versions. All builds prior to 2013-02-28 are affected Severity Rating. Medium Impact. Privilege escalation Attack Vector. From remote with read-only authentication Solution Status. Vendor patch (not verified by SOS) Disable J-Web or limit access CVE reference. CVE - not yet assigned Details. The J-Web is a GUI based network management application used on Junos devices. The web application is vulnerable to a remote code execution vulnerability which permits privilege escalation. The file/jsdm/ajax /port.php allows execution of arbitrary user supplied PHP code via the rs POST parameter. Code executes with UID=0 (root) privileges, however you are confined to a chroot. Privilege escalation can be achieved by waiting for an administrator to log in and reading the contents of /tmp to hijack their session. Proof of Concept. Code execution: Execute a command inside the Chroot: POST /jsdm/ajax/port.php rs=exec&rsargs[]=echo “hello” Privilege escalation: Read /tmp and hijack a session POST /jsdm/ajax/port.php rs=file_get_contents&rsargs[]=/tmp Solution. All Junos OS software releases built on or after 2013-02-28 have fixed this specific issue. This fix has not been validated by SOS. As a workaround disable J-Web, or limit access to only trusted hosts. This issue is being tracked as PR 826518 and is visible on the Juniper Customer Support website. Discovered by. Sense of Security Labs. About us. Sense of Security is a leading provider of information security and risk management solutions. Our team has expert skills in assessment and assurance, strategy and architecture, and deployment through to ongoing management. We are Australia's premier application penetration testing firm and trusted IT security advisor to many of the country's largest organisations.

Products Mentioned

Configuraton 0

Juniper>>Junos >> Version To (including) 10.4

Juniper>>Junos >> Version 10.0

Juniper>>Junos >> Version 10.1

Juniper>>Junos >> Version 10.2

Juniper>>Junos >> Version 10.3

Juniper>>Junos >> Version 11.4

Juniper>>Junos >> Version 12.1

Juniper>>Junos >> Version 12.2

Juniper>>Junos >> Version 12.3

Références

http://www.exploit-db.com/exploits/29544
Tags : exploit, x_refsource_EXPLOIT-DB
http://secunia.com/advisories/54731
Tags : third-party-advisory, x_refsource_SECUNIA
http://www.securityfocus.com/bid/62305
Tags : vdb-entry, x_refsource_BID
http://www.securitytracker.com/id/1029016
Tags : vdb-entry, x_refsource_SECTRACK